Warlock
The Warlock ransomware and operator(s) are believed to be attributed to Storm-2603, a China-based threat actor who is also known to have deployed LockBit ransomware. There's also a crossover between victims with Black Basta. Both are RaaS and have a long list of known and unknown affiliates. Having said that, this is possibly an affiliate (likely a cybergroup) of both of those groups. The Alliance & Association would technically be Encryptor Sharing, but this is realistically more of an "Old Affiliate" that created their own ransomware encryptor and operation.
Extension(s): .x2anylock
Victims
78
First Discovered
victim2025-06-11
Last Discovered
victim2025-11-06
Inactive Since
in days83
Avg Delay
between attack and claim26.6 days
Infostealer
for victim with domain32.7%
Known Locations (4)
Target (Available)
Top 5 Activity Sectors
- Technology 20
- Financial Services 3
- Telecommunication 3
- Agriculture and Food Production 2
- Manufacturing 2
Top 5 Countries
-
United States
12
-
Japan
5
-
Russian Federation
5
-
United Kingdom
4
-
Türkiye
2
Heatmap (Available)
Ransom Notes (2)
Tools Used (Available)
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
SecurityCheck
|
Radmin
|
VMTools AV Killer (BYOVD)
|
Mimikatz
Veeam-Get-Creds
|
Velociraptor
|
Cloudflared
OpenSSH
MinIO
VS Code Tunnel
|
Minidump
|
|
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (0)
No YARA rules available.
Indicators of Compromise (IoCs) (4)
SHA256
1
TOX
3
Victims (78)
energogroup.net
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
goldenline.com
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
bengineered.com.au
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
mnpease.ca
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
metro.local
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
cybervector.co.uk
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
fabrity.local
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
miltech.local
Warlock
Discovery Date: 2025-11-06
Estimated Attack Date: 2025-11-01
Estimated Attack Date: 2025-11-01
No description provided....
infoniqa.com
Warlock
Discovery Date: 2025-08-18
165g data, including internal documents, financial documents, employee information, CRM database, HR...
gmtaconline
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-07-04
Estimated Attack Date: 2025-07-04
The data has been bought by other buyers (not victims)...
orange.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-09
Estimated Attack Date: 2025-08-09
This is only a part of the files and file list. The full set of files needs to be purchased separate...
brightwork.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-09
Estimated Attack Date: 2025-08-09
[AI generated] BrightWork.com is a project management software company that provides solutions for t...
starsalliance.com
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-06
Estimated Attack Date: 2025-08-06
The data has been purchased by other buyers...
wytechnology.local
Warlock
Discovery Date: 2025-08-17
Estimated Attack Date: 2025-08-07
Estimated Attack Date: 2025-08-07
The data has been purchased by other buyers...
via-optronics
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-05-02
Estimated Attack Date: 2025-05-02
[AI generated] Via Optronics is a global technology company that specializes in the production of in...
eira-group
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-04-10
Estimated Attack Date: 2025-04-10
[AI generated] N/A...
nipponindiaim
Warlock
Discovery Date: 2025-06-11
Estimated Attack Date: 2025-04-30
Estimated Attack Date: 2025-04-30
[AI generated] Nippon India Mutual Fund (NIMF), previously known as Reliance Mutual Fund, is one of ...
